CVE-2026-6527: Wireshark ASN.1 PER DOS Vulnerability

CVE-2026-6527 Overview

CVE-2026-6527 is a denial-of-service vulnerability in the Wireshark ASN.1 Packed Encoding Rules (PER) protocol dissector. The flaw affects Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. An attacker can trigger a dissector crash by causing Wireshark to read a crafted capture file or live capture stream. The underlying weakness is classified as uncontrolled recursion [CWE-674]. Successful exploitation terminates the Wireshark process and disrupts protocol analysis workflows.

Critical Impact
A crafted capture or packet stream crashes the Wireshark ASN.1 PER dissector, producing a local denial of service against analysts and automated capture pipelines.

Affected Products

Wireshark 4.6.0 through 4.6.4
Wireshark 4.4.0 through 4.4.14
Deployments using tshark or dumpcap workflows that invoke the PER dissector

Discovery Timeline

2026-04-30 - CVE-2026-6527 published to the National Vulnerability Database
2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-6527

Vulnerability Analysis

The vulnerability resides in the ASN.1 Packed Encoding Rules (PER) dissector shipped with Wireshark. PER is used by many telecom and signaling protocols, including LTE and 5G control-plane messages, which makes the dissector a frequent target during analyst workflows. Parsing a malformed PER-encoded structure drives the dissector into excessive recursion, exhausting the call stack and crashing the process. Because Wireshark automatically invokes dissectors when reading a capture file or processing live traffic, no additional user action beyond opening the file is required after the analyst initiates capture review.

The issue is local in scope. The attacker must deliver a malicious capture file or arrange for Wireshark to ingest the malformed traffic. The impact is limited to availability, with no confidentiality or integrity loss. The EPSS probability remains very low, consistent with a denial-of-service issue that does not yield code execution.

Root Cause

The root cause is uncontrolled recursion [CWE-674] in the PER dissector. The dissector does not bound the depth of nested ASN.1 structures it will descend into during decoding. A crafted message containing deeply nested or self-referential constructs forces repeated recursive calls until the thread stack is exhausted and the process aborts.

Attack Vector

Exploitation requires local user interaction. An attacker sends a malicious pcap or pcapng file to a target analyst, or injects malformed PER traffic onto a network segment being captured. When Wireshark, tshark, or another libwireshark consumer loads the capture, the PER dissector enters the recursive path and crashes. Repeated delivery sustains the denial of service against an analyst workstation or an automated triage pipeline.

No proof-of-concept is published in the referenced advisories. See the Wireshark Security Advisory WNPA-SEC-2026-34 and the GitLab Wireshark Work Item for technical details and the upstream fix.

Detection Methods for CVE-2026-6527

Indicators of Compromise

Unexpected termination of wireshark, tshark, or dumpcap processes shortly after opening a capture file or starting a live capture.
Operating system crash reports or core dumps referencing the PER dissector or epan library frames.
Inbound capture files from untrusted sources containing ASN.1 PER-encoded payloads with abnormally deep nesting.

Detection Strategies

Monitor endpoint telemetry for abnormal exit codes and crash events tied to Wireshark binaries on analyst workstations.
Inspect capture files received over email or file-sharing platforms before opening them with Wireshark, prioritizing samples that originate outside trusted analysis pipelines.
Correlate process termination events with recent file-open or capture-start activity to identify probable exploitation attempts.

Monitoring Recommendations

Enable crash reporting on systems running Wireshark and forward events to a centralized log platform for review.
Track Wireshark version inventory across analyst endpoints to confirm patched builds are deployed.
Alert on repeated Wireshark crashes from the same user or capture source, which may indicate sustained denial-of-service activity.

How to Mitigate CVE-2026-6527

Immediate Actions Required

Upgrade Wireshark to a release that contains the fix referenced in advisory WNPA-SEC-2026-34, beyond 4.6.4 and 4.4.14 respectively.
Restrict opening of capture files received from untrusted sources until patched builds are deployed.
Audit automated capture-processing pipelines, such as malware analysis sandboxes that invoke tshark, and patch them on the same schedule as analyst workstations.

Patch Information

Wireshark Foundation released fixed builds tracked under advisory WNPA-SEC-2026-34. Refer to the Wireshark Security Advisory WNPA-SEC-2026-34 for the corrected version numbers and to the GitLab Wireshark Work Item for the upstream code change addressing the uncontrolled recursion in the ASN.1 PER dissector.

Workarounds

Disable the ASN.1 PER dissector in Analyze > Enabled Protocols when analyzing untrusted captures that do not require PER decoding.
Process untrusted capture files inside an isolated virtual machine or container so that a dissector crash does not affect the primary analyst workstation.
Use editcap or similar tooling to strip or slice unknown protocol payloads from third-party captures before loading them into a full Wireshark session.

bash

# Verify installed Wireshark version and disable the PER dissector for untrusted captures
wireshark --version
tshark -G protocols | grep -i per
tshark --disable-protocol per -r untrusted.pcapng